It downloads them and stores in serverside cache before you ever open the email
Frankly the best outcome as it makes them useless.
That does mean the email address exists though which was what HSBC was questioning.
Frankly the best outcome as it makes them useless.